A password generator makes passwords that no person chose
Pick a length and the characters to include, and this tool builds a random password that fits those conditions. The default is 16 characters mixing lowercase letters, uppercase letters, digits and 16 symbols. That setting can produce about 1.62 × 1030 different passwords, or roughly 100.4 bits. If a site accepts only certain symbols, you can pick the symbols one by one to match.
If you have to memorize and type the password yourself, a word passphrase made of a few English words is the better fit. For a door lock or phone that only takes digits, choose a numeric PIN. All three types are built from your browser's secure random numbers, and the result is never sent to a server or stored.
Why generate a password instead of thinking one up
A password a person comes up with tends to grow out of guessable material such as names, birthdays, favorite words and keyboard patterns. A randomly generated string has none of that material to guess from. NIST's digital identity guidelines (SP 800-63B-4) also note that password managers have been shown to increase the likelihood that people choose stronger passwords, particularly when the manager includes a password generator.
This tool is most useful in situations like these.
- Creating a new account: a different password for every account means one leak cannot open the others. Since you will store it in a manager, make a long random one.
- After a breach notice: every account that used the exposed password needs a new value. If there are several, press Regenerate and make a separate password for each.
- Wi-Fi and device admin passwords: use it to replace the factory default. If you have to read the password out loud to a guest, turn on 'Exclude look-alike characters' so 0 and O are not confused.
- Passwords you must remember: a password manager's master password or a computer login that you type every time is easier to remember as a word passphrase, and it can still be long.
- Places that take digits only: for door locks, phone lock screens and card PINs, use the PIN type. It can skip easy runs such as 111 or 123.
How to use it
- Choose a type at the top. A random 16-character password is already generated when the page opens.
- Type a number in the length box, drag the slider, or tap a preset (12, 16, 20, 32, 64). Changing the value generates a new password.
- Turn the four character cards (lowercase, uppercase, digits, symbols) on or off. For symbols, keep only the ones you want among the 32 chips below. If you dislike look-alikes such as 0 and O, turn on 'Exclude look-alike characters'.
- Check the result in the display. Characters are grouped in fours with position numbers, digits are shaded gray and symbols orange, so you do not lose your place when copying by hand. Press 'Hide' if someone could see your screen.
- Press Copy, paste it into the sign-up form, and save the same value in your password manager. If you want a different value with the same settings, press Regenerate.
Three types: which one to choose
| Type | Default | Combinations | Good for |
|---|---|---|---|
| Random characters | 16 characters: lowercase, uppercase, digits, 16 symbols | 100.4 bits | Accounts where you paste from a password manager |
| Word passphrase | 5 English words joined by hyphens | 64.6 bits | Master password, computer login |
| Numeric PIN | 6 digits, avoiding 3 repeated or 3 sequential digits | 19.8 bits | Door locks, phone lock, cards |
A bigger number means more possible passwords, but the right type depends on where it will be used. A PIN can be useful at only 19.8 bits because the device that asks for it usually locks after a few wrong tries. NIST's guidelines likewise require limiting consecutive failed attempts to no more than 100 per account. A website password is different: if the service is breached and the stored values leak, they can be tried offline without any lockout, so a longer password is the safer choice.
How the number of combinations grows with length and character types
The table below is counted the same way as the meter in the tool. Each selected type must appear at least once, so strings that skip a selected type are not counted.
| Length | Digits only | Lowercase only | Upper + lower | Letters + digits | + 16 symbols | + 32 symbols |
|---|---|---|---|---|---|---|
| 8 chars | 26.6 | 37.6 | 45.6 | 47.2 | 49.2 | 51.3 |
| 12 chars | 39.9 | 56.4 | 68.4 | 71.3 | 75.0 | 78.1 |
| 16 chars | 53.2 | 75.2 | 91.2 | 95.2 | 100.4 | 104.6 |
| 20 chars | 66.4 | 94.0 | 114.0 | 119.0 | 125.6 | 130.9 |
| 32 chars | 106.3 | 150.4 | 182.4 | 190.5 | 201.1 | 209.7 |
Read across a row to see what adding a character type does, and down a column to see what extra length does. Adding 16 symbols to a 16-character letters-and-digits password (95.2 bits) gives 100.4 bits, a gain of 5.2. Staying without symbols and going to 20 characters gives 119.0 bits, a gain of 23.8. So if a site refuses symbols, a few extra characters more than make up for it. The line next to the meter, 'One more character adds +bits', shows what one character is worth under your current settings.
How many words are enough
The word passphrase uses the English word list that the Electronic Frontier Foundation (EFF) designed for picking words with dice. The list has 7,776 words, and this tool drops the 4 that contain a hyphen (drop-down and others), leaving 7,772. They are dropped so that, with a hyphen as the separator, two different sets of words can never look like the same text. Each word is worth about 12.9 bits. Words are 3 to 9 letters long, 7 on average, so five words joined by hyphens usually come to around 39 characters.
| Words | As is | With one digit |
|---|---|---|
| 3 words | 38.8 | 43.7 |
| 4 words | 51.7 | 57.0 |
| 5 words | 64.6 | 70.3 |
| 6 words | 77.5 | 83.5 |
| 7 words | 90.5 | 96.6 |
The UK's National Cyber Security Centre (NCSC) advises combining three random words for everyday accounts. The EFF suggests a six-word passphrase for most applications, so for a master password that protects all your other accounts, five or six words is the better target. 'Capitalize first letter' is only there to satisfy sites that demand a capital, and it does not add combinations. 'Add one digit' attaches a single digit to the end of one word, so it multiplies the count by 10 and by the number of places it can go.
Numeric PINs and runs of digits
Each position in a PIN is one of 0 to 9. With 'Avoid 3 repeated or 3 sequential digits' on, the generator leaves out PINs that contain the same digit three times in a row, such as 111, or three digits that step by 1 up or down, such as 123 or 987. A 0 after a 9 is not counted as a run.
| Digits | All | Avoiding on | Excluded | Bits (on) |
|---|---|---|---|---|
| 4 digits | 10,000 | 9,504 | 5.0% | 13.21 |
| 6 digits | 1,000,000 | 904,728 | 9.5% | 19.79 |
| 8 digits | 100,000,000 | 86,125,524 | 13.9% | 26.36 |
Dropping those PINs costs well under a bit of strength. In return, the PINs someone would guess first do not come up, and you do not have to regenerate for devices that reject such patterns. A number tied to you, such as a birthday or phone number, is something this tool cannot know, so if the result happens to match one, generate again.
Why every site has different password rules
Many sites still demand a mix of uppercase, lowercase, digits and symbols, cap the length at 12 or 20, or reject certain symbols. NIST's current guidance goes the other way.
Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
NIST SP 800-63B-4 · August 2025 · checked 2026-10-22
Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
The same section asks services to permit a maximum password length of at least 64 characters and to verify the entire submitted password without truncating it. Real sites do not all follow this, so the generator has to adapt to them. Read the hint on the sign-up page for allowed symbols and the maximum length, then set the symbol chips and the length to match. If a site rejects the result, read the message to find which character it dislikes, turn off just that symbol and generate again.
How the random characters are chosen
Randomness comes from crypto.getRandomValues() in the browser's Web Crypto API. The W3C specification defines it as filling bytes with cryptographically secure random bytes. The clock and Math.random() are never used for the password, only for the spinning effect on the display.
- Picking one character without bias: taking a 32-bit random number modulo the number of candidates would make the earlier characters very slightly more common. So values above the last full multiple of the candidate count are thrown away and drawn again.
- Every selected type appears: if you turn on digits and the result has none, the whole string is discarded and drawn again from scratch. Every string that meets the conditions has the same probability, which would not be true if a digit were pushed into a spare slot. At the default 16 characters about 86% of draws pass first time, so redraws are rare.
- The number of combinations is counted, not estimated: random characters use inclusion-exclusion, word passphrases multiply 7,772 once per word, and PINs that avoid runs are counted position by position while remembering the previous two digits. The exact count is then converted to bits.
Storing and typing it afterwards
A random password is not something to memorize. Copy it, paste it into the site, save the same value in your password manager, then sign out and sign back in with the new password to confirm it was saved correctly. NIST's guidelines say services must allow password managers and autofill, and should permit pasting.
- The copied value can stay in your operating system's clipboard history or sync to other devices. After pasting, copy some other text once to overwrite it.
- For a TV or game console that does not allow pasting, read the numbered groups on the display and type four characters at a time. Turn on 'Exclude look-alike characters' before generating.
- If you are sharing your screen in a meeting, press 'Hide' before generating. You can still copy while it is hidden.
Common mistakes
- Pasting an old value after changing settings: changing the length, types or symbols generates a new password. Finish the settings first and copy last.
- Going over the site's maximum length: if the input box has a character limit, the tail can be cut off silently when you paste, and the value in your manager no longer matches the real password. If a maximum is stated, stay within it.
- Turning off symbols and worrying about strength: dropping symbols and adding 4 characters gains more than they cost. Compare the 16 and 20 character rows in the table above.
- Editing a passphrase by hand: swapping in words you like makes it no longer random. If you do not like it, press Regenerate.
- Reusing one password in several places: even a generated password puts every account at risk if one site leaks it. Make a separate one for each account.
Limits and cautions
- The bits on the meter are only the number of possible results for these settings. They are not a cracking time or a safety grade. Real risk depends on how the service stores passwords, whether it limits login attempts, and whether you used the same value elsewhere.
- There is no feature to check whether a password you already use has leaked, or to rate its strength. Do not type your existing passwords into other sites to test them.
- Word passphrases use English words only. This tool uses no vetted public word list for other languages, and many sites do not accept non-ASCII characters in a password.
- A random password typed into a phishing page is handed over just the same. If a service offers passkeys or a second factor, turn them on as well.
- If the device has malware or a browser extension that watches the screen, this tool cannot prevent that.
Sources
Checked NIST SP 800-63B-4, W3C Web Cryptography, and the EFF and NCSC pages were checked against the original text on October 22, 2026. The bit values in the tables were computed with this tool's own counting code, and small cases were verified by counting every combination one by one.
- 01NIST SP 800-63B-4: Authentication and Authenticator ManagementAugust 2025. 3.1.1 passwords of at least 15 or 8 characters, 64-character maximum, no composition rules, managers and paste allowed; 3.2.2 limit of 100 consecutive failures
- 02W3C Web Cryptography Level 2: getRandomValuesCryptographically secure random bytes, up to 65,536 bytes per call
- 03EFF: Dice-Generated PassphrasesLarge wordlist of 7,776 words, six words suggested for most applications
- 04NCSC: Three random wordsUK National Cyber Security Centre advice to combine three random words
Frequently asked questions
How long should my password be?
As long as the site accepts. NIST SP 800-63B-4 requires at least 15 characters when a password is the only factor and at least 8 when it is used as part of multi-factor authentication. This tool's default of 16 characters (lowercase, uppercase, digits and 16 symbols) is about 100.4 bits.
Should I choose random characters or a word passphrase?
For accounts where you paste from a password manager, random characters give more combinations at a shorter length. For something you must memorize and type, such as a computer login or a manager's master password, a word passphrase fits better. Five words are about 64.6 bits and six are about 77.5 bits, and the EFF suggests six words for most applications.
What if a site allows only certain symbols?
Keep only the symbols that site accepts in the symbol chips. Only the chosen symbols become candidates, and while the Symbols card is on, at least one symbol is included. If the site accepts no symbols at all, turn the Symbols card off.
Is the generated password stored on a server?
No. It is generated inside this browser and is neither sent to a server nor recorded. A copied value can remain in your operating system's clipboard history or sync between devices, so check that after pasting.
What do the bits on the meter mean?
They express the number of possible passwords for the same settings as a power of 2. 100 bits is 2 to the 100th power, about 1.27 × 10 to the 30th. Each extra bit doubles the count. How long cracking takes depends on how the service stores passwords and limits logins, so this value alone cannot tell you.
Which characters does 'Exclude look-alike characters' remove?
It removes the digits 0 and 1, the capital letters O and I, the lowercase letters o and l, and the vertical bar |. They are easier to read when you copy a password to another device by sight. The smaller pool lowers the count, so the default 16-character setting goes from about 100.4 bits to 98.1 bits.
What does avoiding 3 repeated or 3 sequential digits remove from a PIN?
It removes PINs with the same digit three times in a row, such as 111, or three digits rising or falling by 1, such as 123 or 987. Of the 1,000,000 six-digit PINs, 904,728 remain, so 9.5% are removed and the count drops only slightly, from about 19.9 bits to 19.8 bits.
Can I get an earlier password back after regenerating?
No. This tool does not record what it generates, so the previous value is gone once you press Regenerate or leave the page. Copy the password you plan to use and save it in the site and your password manager right away.